If you run a small or mid-sized business, you can no longer ignore cybersecurity compliance. Every U.S. state has its own breach notification law, and regulators don’t care whether you’re a 3-person roofing company or a 200-person medical practice.
These laws define how quickly you must notify customers when data is breached, and they carry steep fines if you fail to comply.
Below is the definitive state-by-state guide for SMBs in 2025, including timelines and penalties where available.
State-by-State Breach Notification Laws (with Penalties)
Alabama: Data Breach Notification Act (2018) – 45-day notification deadline. Fines up to $5,000 per day for each day of noncompliance.
Alaska: Personal Information Protection Act – notification without unreasonable delay. Civil penalties vary.
Arizona: Breach Notification Law – 45-day notification deadline. Fines up to $10,000 per violation (capped at $500,000).
Arkansas: Personal Information Protection Act – notify “in the most expedient time possible.” Civil penalties vary.
California: CCPA/CPRA – notice required without unreasonable delay. Fines up to $2,500 per violation or $7,500 per intentional violation. Private lawsuits allowed for $100–$750 per affected consumer.
Colorado: Protections for Consumer Data Privacy Act – 30-day notification. Fines up to $2,000 per violation, capped at $500,000.
Connecticut: Breach Notification Law – 60-day deadline. Penalties include $5,000 per willful violation. Must provide free credit monitoring for SSN breaches.
Delaware: Data Breach Notification Law – 60-day deadline. Fines up to $10,000 per violation.
Florida: Information Protection Act – 30-day deadline. Fines of $1,000 per day for the first 30 days, then $50,000 per 30-day period, capped at $500,000.
Georgia: Breach Notification Law – notice without unreasonable delay. Civil penalties vary.
Hawaii: Breach Notification Law – notice without unreasonable delay. Civil penalties vary.
Idaho: Breach Notification Law – notice without unreasonable delay. Civil penalties vary.
Illinois: Personal Information Protection Act – includes biometrics. Civil penalties vary, but Illinois BIPA allows $1,000 per negligent violation and $5,000 per reckless violation.
Indiana: Breach Notification Law – 45-day deadline. Civil penalties vary.
Iowa: Breach Notification Law – notice without unreasonable delay. Civil penalties vary.
Kansas: Breach Notification Law – notice without unreasonable delay. Civil penalties vary.
Kentucky: Breach Notification Law – notice without unreasonable delay. Civil penalties vary.
Louisiana: Database Security Breach Notification Law – notice without unreasonable delay. Penalties up to $5,000 per violation.
Maine: Data Breach Notification Law – notice without unreasonable delay. Civil penalties vary.
Maryland: Personal Information Protection Act – 45-day deadline. Civil penalties up to $1,000 per violation.
Massachusetts: Data Breach Notification Law – requires encryption of PII. Civil penalties up to $5,000 per violation.
Michigan: Identity Theft Protection Act – notice without unreasonable delay. Civil penalties vary.
Minnesota: Breach Notification Law – notice without unreasonable delay. Civil penalties vary.
Mississippi: Breach Notification Law – notice without unreasonable delay. Civil penalties vary.
Missouri: Breach Notification Law – 45-day deadline. Civil penalties vary.
Montana: Consumer Protection Act – notice without unreasonable delay. Civil penalties vary.
Nebraska: Data Breach Notification Law – notice without unreasonable delay. Civil penalties vary.
Nevada: Security of Personal Information Law – notice without unreasonable delay; encryption required. Civil penalties up to $5,000 per violation.
New Hampshire: Breach Notification Law – 45-day deadline. Civil penalties vary.
New Jersey: Identity Theft Prevention Act – notice without unreasonable delay. Civil penalties vary.
New Mexico: Data Breach Notification Act – 45-day deadline. Civil penalties up to $25,000 per violation.
New York: SHIELD Act – requires “reasonable safeguards.” Fines of $5,000 per violation and up to $250,000 total.
North Carolina: Identity Theft Protection Act – notice without unreasonable delay. Civil penalties vary.
North Dakota: Personal Information Protection Act – notice without unreasonable delay. Civil penalties vary.
Ohio: Data Protection Act – notification law; safe harbor for NIST/ISO adopters. Civil penalties vary.
Oklahoma: Breach Notification Act – notice without unreasonable delay. Civil penalties vary.
Oregon: Consumer Identity Theft Protection Act – prompt notification. Civil penalties up to $1,000 per violation.
Pennsylvania: Breach Notification Law – notice without unreasonable delay. Civil penalties vary.
Rhode Island: Identity Theft Protection Act – 45-day deadline. Fines up to $100 per record, capped at $25,000.
South Carolina: Identity Theft Protection Act – notice without unreasonable delay. Civil penalties vary.
South Dakota: Breach Notification Law – 45-day deadline. Civil penalties vary.
Tennessee: Information Protection Act – notice without unreasonable delay. Civil penalties vary.
Texas: Identity Theft Enforcement and Protection Act – 60-day deadline. Civil penalties up to $50,000 per violation.
Utah: Protection of Personal Information Act – notice without unreasonable delay. Civil penalties vary.
Vermont: Security Breach Notice Act – notice without unreasonable delay. Civil penalties vary.
Virginia: Breach Notification Law – notice without unreasonable delay. Civil penalties vary.
Washington: Breach Notification Law – 30-day deadline. Civil penalties up to $2,000 per violation.
West Virginia: Consumer Credit and Protection Act – notice without unreasonable delay. Civil penalties vary.
Wisconsin: Breach Notification Law – notice without unreasonable delay. Civil penalties vary.
Wyoming: Breach Notification Law – notice without unreasonable delay. Civil penalties vary.
What This Means for SMBs
You can’t hide a breach. Regulators require proof of notification.
Penalties compound. Fines are often per record, per violation.
Cross-state exposure multiplies risk. If you serve customers in 5 states, you must comply with 5 different laws.
Doing nothing makes it worse. Regulators hit harder when you ignore known exposures.
How CybrogenIT Protects SMBs
CybrogenIT helps SMBs stay compliant with every state’s laws:
Breach detection and dark web scans (surface, deep, and dark web).
State-specific compliance support (timelines, reporting, regulator coordination).
Breach notification assistance so you meet legal deadlines.
Immutable backups and ransomware response.
Employee security training to reduce human error.
24/7 monitoring to detect unauthorized access.
Every state has a breach law, and many have steep fines. California, Florida, New York, Texas, and Colorado lead with aggressive penalties, but all states enforce compliance.
For SMBs, the risk isn’t just fines; it’s downtime, customer loss, lawsuits, and insurance denial.
CybrogenIT provides enterprise-grade compliance and cybersecurity solutions to SMBs, enabling you to focus on your business while we protect your data and reputation.